Infotech Lead America: McAfee says Malware is shifting its focus to factories, corporations, government agencies and infrastructure that connect these new areas.
“We are seeing attacks shifting into a variety of new areas, from factories, to corporations, to government agencies, to the infrastructure that connects them together,” said Vincent Weafer, senior vice president of McAfee Labs.
McAfee claims that this represents a new chapter in cyber security in that threat-development, driven by the lure of financial industry profits, has created a growing underground market for these cybercrime weapons, as well as creative new approaches to thwarting security measures common across industries.
In Q4 2012, McAfee Labs found that unique password-stealing trojans grew 72 percent in Q4 as cybercriminals realized that user authentication credentials constitute some of the most valuable intellectual property stored on most computers. These trojans are now widely available and increasingly appearing within customized threats or combined with other off-the-shelf threats available on the internet.
The Citadel trojan’s information theft capabilities are now found to be deployed beyond the financial services sector.
Suspicious URLs continued to replace botnets as the primary distribution mechanism for malware. The number of new suspicious URLs increased by 70 percent in Q4.
New suspect URLs averaged 4.6 million per month, almost doubling the previous 2.7 million per month figure from the last two quarters. Ninety-five percent of these URLs were found to be hosting malware, exploits or code designed specifically to compromise computers.
Though law enforcement efforts have caused a decline in the number of infected systems controlled by botnet operators, the declining appeal of the botnet business model is a more prominent cause of the decline.
The volume of Master Boot Record-related malware climbed 27 percent, the highest in the quarter. These threats embed themselves deep within the PC system storage stack and steal user information, download other malicious software, or leverage the infected PC’s computing power to launch attacks against other PCs or networks. Standard antivirus solutions cannot detect them. Currently MBR attacks represent a relatively small portion of the overall PC malware landscape, but McAfee Labs expects them to become a primary attack vector in 2013.
The number of electronically-signed malware samples doubled over the course of Q4, indicating that cybercriminals are resorting to signing malware binaries to circumvent standard system security measures.
The number of mobile malware samples discovered by McAfee Labs in 2012 was 44 times the number found in 2011. The mobile Android platform is an easy target for cybercriminals. Q4 alone saw an 85 percent jump of new Android-based malware samples.
The information found on mobile devices, including passwords and address books, as well as new “business” opportunities are not available on the PC platform. Mobiles can be affected by Trojans that send SMS messages to premium services, then charge the user for each message sent.
